Up For Vote: Senate Bill Let's Feds Read Your Emails Without Warrants

CNET has learned that Patrick Leahy, the influential Democratic chairman of the Senate Judiciary committee, has dramatically reshaped his legislation in response to law enforcement concerns. A vote on his bill, which now authorizes warrantless access to Americans' e-mail, is scheduled for next week.

Revised bill highlights

Leahy's rewritten bill would allow more than 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant. It also would give the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge.

Leahy's rewritten bill would allow more than 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant.

It also would give the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge. (CNET obtained the revised draft from a source involved in the negotiations with Leahy.)It's an abrupt departure from Leahy's earlier approach, which required police to obtain a search warrant backed by probable cause before they could read the contents of e-mail or other communications.

The Vermont Democrat boastedlast year that his bill "provides enhanced privacy protections for American consumers by... requiring that the government obtain a search warrant."Leahy had planned a vote on an earlier version of his bill, designed to update a pair of 1980s-vintage surveillance laws, in late September. But after law enforcement groups including the National District Attorneys' Association and the National Sheriffs' Association organizations objected to the legislation and asked him to "reconsider acting" on it, Leahy pushed back the vote and reworked the bill as a package of amendments to be offered next Thursday.

The package (PDF) is a substitute for H.R. 2471, which the House of Representatives already has approved.One person participating in Capitol Hill meetings on this topic told CNET that Justice Department officials have expressed their displeasure about Leahy's original bill. The department is on record as opposing any such requirement: James Baker, the associate deputy attorney general, has publicly warned that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.Christopher Calabrese, legislative counsel for the American Civil Liberties Union, said requiring warrantless access to Americans' data "undercuts" the purpose of Leahy's original proposal. "We believe a warrant is the appropriate standard for any contents," he said.
An aide to the Senate Judiciary committee told CNET that because discussions with interested parties are ongoing, it would be premature to comment on the legislation.Marc Rotenberg, head of the Electronic Privacy Information Center, said that in light of the revelations about how former CIA director David Petraeus' e-mail was perused by the FBI, "even the Department of Justice should concede that there's a need for more judicial oversight," not less.Markham Erickson, a lawyer in Washington, D.C. who has followed the topic closely and said he was speaking for himself and not his corporate clients, expressed concerns about the alphabet soup of federal agencies that would be granted more power:

❝ There is no good legal reason why federal regulatory agencies such as the NLRB, OSHA, SEC or FTC need to access customer information service providers with a mere subpoena. If those agencies feel they do not have the tools to do their jobs adequately, they should work with the appropriate authorizing committees to explore solutions. The Senate Judiciary committee is really not in a position to adequately make those determinations. ❞

The list of agencies that would receive civil subpoena authority for the contents of electronic communications also includes the Federal Reserve, the Federal Trade Commission, the Federal Maritime Commission, the Postal Regulatory Commission, the National Labor Relations Board, and the Mine Enforcement Safety and Health Review Commission.Leahy's modified bill retains some pro-privacy components, such as requiring police to secure a warrant in many cases. But the dramatic shift, especially the regulatory agency loophole and exemption for emergency account access, likely means it will be near-impossible for tech companies to support in its new form.
A bitter setback
This is a bitter setback for Internet companies and a liberal-conservative-libertarian coalition, which had hoped to convince Congress to update the 1986 Electronic Communications Privacy Act to protect documents stored in the cloud. Leahy glued those changes onto an unrelatedprivacy-related bill supported by Netflix.
At the moment, Internet users enjoy more privacy rights if they store data on their hard drives or under their mattresses, a legal hiccup that the companies fear could slow the shift to cloud-based services unless the law is changed to be more privacy-protective.
Members of the so-called Digital Due Process coalition include Apple, Amazon.com, Americans for Tax Reform, AT&T, the Center for Democracy and Technology, eBay, Google, Facebook, IBM, Intel, Microsoft, TechFreedom, and Twitter. (CNET was the first to report on the coalition's creation.)Leahy, a former prosecutor, has a mixed record on privacy. He criticized the FBI's efforts to require Internet providers to build in backdoors for law enforcement access, and introduced a bill in the 1990s protecting Americans' right to use whatever encryption products they wanted.

But he also authored the 1994 Communications Assistance for Law Enforcement Act, which is now looming over Web companies, as well as the reviledProtect IP Act. An article in The New Republic concluded Leahy's work on the Patriot Act "appears to have made the bill less protective of civil liberties." Leahy had introduced significant portions of the Patriot Act under the name Enhancement of Privacy and Public Safety in Cyberspace Act (PDF) a year earlier.One obvious option for the Digital Due Process coalition is the simplest: if Leahy's committee proves to be an insurmountable roadblock in the Senate, try the courts instead.
Judges already have been wrestling with how to apply the Fourth Amendment to an always-on, always-connected society. Earlier this year, the U.S. Supreme Court ruled that police needed a search warrant for GPS tracking of vehicles. Some courts have ruled that warrantless tracking of Americans' cell phones, another coalition concern, is unconstitutional.The FBI and other law enforcement agencies already must obtain warrants for e-mail in Kentucky, Michigan, Ohio, and Tennessee, thanks to a ruling by the 6th Circuit Court of Appeals in 2010.

After public criticism of proposal that lets government agencies warrantlessly access Americans' e-mail, Sen. Patrick Leahy says he will "not support" such an idea at next week's vote. by Declan McCullagh
November 20, 2012 12:35 PM PST

Sen. Patrick Leahy won't support warrantless e-mail access, although an aide said only broad exceptions were off the table.
(Credit: U.S. Senate)

Sen. Patrick Leahy has abandoned his controversial proposal that would grant government agencies more surveillance power -- including warrantless access to Americans' e-mail accounts -- than they possess under current law.

The Vermont Democrat said today on Twitter that he would "not support such an exception" for warrantless access. The remarks came a few hours after a CNET article was published this morning that disclosed the existence of the measure.
A vote on the proposal in the Senate Judiciary committee, which Leahy chairs, is scheduled for next Thursday. The amendments were due to be glued onto a substitute (PDF) to H.R. 2471, which the House of Representatives already has approved.

Leahy's about-face comes in response to a deluge of criticism today, including the American Civil Liberties Union saying that warrants should be required, and the conservative group FreedomWorks launching a petition to Congress -- with more than 2,300 messages sent so far -- titled: "Tell Congress: Stay Out of My Email!"
A spokesman for the senator did not respond to questions today from CNET asking for clarification of what Leahy would support next week. (We'll update this article if we receive a response.)

A Democratic aide to the Judiciary committee did, however, tell CNET this afternoon that Leahy does not support broad exceptions for warrantless searches of e-mail content.

A note from Leahy's Twitter account added: "Technology has created vacuum in privacy protection. Sen. Leahy believes that needs to be fixed, and #ECPA needs privacy updates." That's a reference to the 1986 Electronic Communications Privacy Act, which currently does not require that police always obtain a warrant for the contents of e-mail and other communications.

This revised position will come as a relief to privacy advocates and business lobbyists, who have been scrambling since last week to figure out how to respond to Leahy's revamped legislation. Some portions would have imposed new restrictions on law enforcement, while others would lessen existing ones, making the overall bill unpalatable to many groups.

The Center for Democracy and Technology, which is coordinating an industry coalition pressing for surveillance reforms, said today that: "We wouldn't support the rewrite described in CNET." (Members of the coalition include Apple, Amazon.com, Americans for Tax Reform, AT&T, the Center for Democracy and Technology, eBay, Google, Facebook, IBM, Intel, Microsoft, TechFreedom, and Twitter.)Related posts

Leahy's proposal would have allowed over 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant. It also would have given the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge.

That was an abrupt departure from Leahy's earlier approach, which required police to obtain a search warrant backed by probable cause before they could read the contents of e-mail or other communications. He boasted last year that his bill "provides enhanced privacy protections for American consumers by... requiring that the government obtain a search warrant."

One person participating in Capitol Hill meetings on this topic told CNET that Justice Department officials have expressed their displeasure about Leahy's original bill. The department is on record as opposing any such requirement: James Baker, the associate deputy attorney general, has publicly warned that requiring a warrant to obtain stored e-mail could have an "adverse impact" on criminal investigations.

Leahy, a former prosecutor, has a mixed record on privacy. He criticized the FBI's efforts to require Internet providers to build in backdoors for law enforcement access, and introduced a bill in the 1990s protecting Americans' right to use whatever encryption products they wanted.